From 9764f67619065a5aaa6869a595eac30c9286357c Mon Sep 17 00:00:00 2001
From: neil <gitsrc@neilpang.com>
Date: Sat, 4 Jul 2026 21:58:57 +0800
Subject: [PATCH] dns_cn: convert IDN domain to punycode before API calls

Core-Networks' API rejects Unicode domain names with "invalid domain";
it requires punycode. dns_cn_add / dns_cn_rm passed the raw challenge
domain straight through, so IDN certs failed at the TXT add step
(issue #4804). Run fulldomain through _idn() in both functions. For
ASCII/punycode input _idn() is a pass-through, so non-IDN domains are
unaffected.

Fixes #4804
---
 dnsapi/dns_cn.sh | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/dnsapi/dns_cn.sh b/dnsapi/dns_cn.sh
index 79698e88..e06a2be6 100644
--- a/dnsapi/dns_cn.sh
+++ b/dnsapi/dns_cn.sh
@@ -15,7 +15,8 @@ CN_API="https://beta.api.core-networks.de"
 ########  Public functions  #####################
 
 dns_cn_add() {
-  fulldomain=$1
+  # Core-Networks API requires punycode for IDN domains
+  fulldomain=$(_idn "$1")
   txtvalue=$2
 
   if ! _cn_login; then
@@ -58,7 +59,8 @@ dns_cn_add() {
 }
 
 dns_cn_rm() {
-  fulldomain=$1
+  # Core-Networks API requires punycode for IDN domains
+  fulldomain=$(_idn "$1")
   txtvalue=$2
 
   if ! _cn_login; then